Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit6900aea

Browse files
committed
Reject CancelRequestPacket having unexpected length.
When the length was too short, the server read outside the allocation.That yielded the same log noise as sending the correct length with(backendPID,cancelAuthCode) matching nothing. Change to a message aboutthe unexpected length. Given the attacker's lack of control over thememory layout and the general lack of diversity in memory layouts at thecode in question, we doubt a would-be attacker could cause a segfault.Hence, while the report arrived via security@postgresql.org, this is nota vulnerability. Back-patch to v11 (all supported versions).Andrey Borodin, reviewed by Tom Lane. Reported by Andrey Borodin.
1 parent21c0586 commit6900aea

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

‎src/backend/postmaster/postmaster.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2019,6 +2019,13 @@ ProcessStartupPacket(Port *port, bool ssl_done, bool gss_done)
20192019

20202020
if (proto==CANCEL_REQUEST_CODE)
20212021
{
2022+
if (len!=sizeof(CancelRequestPacket))
2023+
{
2024+
ereport(COMMERROR,
2025+
(errcode(ERRCODE_PROTOCOL_VIOLATION),
2026+
errmsg("invalid length of startup packet")));
2027+
returnSTATUS_ERROR;
2028+
}
20222029
processCancelRequest(port,buf);
20232030
/* Not really an error, but we don't want to proceed further */
20242031
returnSTATUS_ERROR;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp